deploy: c7a6362 — 更新 entrypoint.sh

huggingface/entrypoint.sh

@@ -1,47 +1,44 @@
 #!/usr/bin/env bash
-# ─────────────────────────────────────────────────────────────────────────────
-# entrypoint.sh — container startup for Hugging Face Spaces
-#
-# Responsibilities:
-#   1. Apply sensible defaults for any env vars not set via HF Space secrets
-#   2. Ensure required directories exist and are writable (ephemeral /tmp)
-#   3. Sanity-check required files baked into the image
-#   4. Hand off to supervisord (which manages litellm, backend, nginx)
-#
-# Environment variables (set in HF Space → Settings → Repository secrets):
-#
-#   LITELLM_MASTER_KEY   Required. Admin key for LiteLLM proxy.
-#   JWT_SECRET           Required. Secret for backend session tokens.
-#   GATEWAY_PUBLIC_URL   Required. Public URL of this Space, e.g.
-#                          https://<user>-<space>.hf.space
-#                          (auto-set by the GitHub Actions workflow)
-#   DB_PATH              Optional. SQLite path. Default: /app/data/gateway.db
-#   LOG_LEVEL            Optional. Winston log level. Default: http
-#
-#   Provider API keys (optional, set whichever you use):
-#   OPENAI_API_KEY, ANTHROPIC_API_KEY, GROQ_API_KEY, GEMINI_API_KEY, …
-# ─────────────────────────────────────────────────────────────────────────────
+# entrypoint.sh - HF Spaces container startup
+# LiteLLM v1.81+ requires PostgreSQL for /model/new API.
 set -euo pipefail
 
-echo "──────────────────────────────────────────"
-echo " AI Gateway Hub — starting (HF Spaces)"
-echo "──────────────────────────────────────────"
+echo "AI Gateway Hub - starting (HF Spaces)"
+echo "======================================"
+
+# 1. DATABASE_URL - required for LiteLLM v1.81+ model registration
+if [ -z "${DATABASE_URL:-}" ]; then
+  echo "WARNING: DATABASE_URL is not set."
+  echo "LiteLLM v1.81+ requires PostgreSQL for /model/new API."
+  echo "Without it all model registrations return HTTP 500."
+  echo ""
+  echo "Get a free PostgreSQL URL from:"
+  echo "  Neon:     https://neon.tech"
+  echo "  Supabase: https://supabase.com"
+  echo "  Railway:  https://railway.app"
+  echo ""
+  echo "Add to HF Space Settings -> Repository secrets:"
+  echo "  DATABASE_URL = postgresql://user:pass@host:5432/dbname"
+fi
+export DATABASE_URL="${DATABASE_URL:-}"
 
-# ── 1. Defaults for optional / missing env vars ───────────────────────────────
+# 2. LITELLM_SALT_KEY - encrypts API keys stored in DB
+if [ -z "${LITELLM_SALT_KEY:-}" ]; then
+  echo "WARNING: LITELLM_SALT_KEY not set - stored API keys will not be encrypted."
+  echo "IMPORTANT: Never change this after adding models."
+fi
+export LITELLM_SALT_KEY="${LITELLM_SALT_KEY:-}"
 
-# LITELLM_MASTER_KEY is critical — warn loudly if using the insecure default
+# 3. Other secrets
 if [ -z "${LITELLM_MASTER_KEY:-}" ]; then
   export LITELLM_MASTER_KEY="sk-gateway-hf-insecure-change-me"
-  echo "⚠️  WARNING: LITELLM_MASTER_KEY not set. Using insecure default."
-  echo "    Set it in: HF Space → Settings → Repository secrets"
+  echo "WARNING: LITELLM_MASTER_KEY not set. Using insecure default."
 fi
 
 if [ -z "${JWT_SECRET:-}" ]; then
-  # Generate a random secret at runtime; sessions won't survive restarts
-  # but this is acceptable for a demo Space.
   export JWT_SECRET
   JWT_SECRET=$(python3 -c "import secrets; print(secrets.token_hex(32))")
-  echo "ℹ️  JWT_SECRET not set — generated an ephemeral secret for this session."
+  echo "INFO: JWT_SECRET not set - generated ephemeral secret."
 fi
 
 export GATEWAY_PUBLIC_URL="${GATEWAY_PUBLIC_URL:-http://localhost:7860}"
@@ -50,51 +47,54 @@ export LOG_LEVEL="${LOG_LEVEL:-http}"
 export NODE_ENV="${NODE_ENV:-production}"
 
 echo "GATEWAY_PUBLIC_URL : ${GATEWAY_PUBLIC_URL}"
-echo "DB_PATH            : ${DB_PATH}"
-echo "LOG_LEVEL          : ${LOG_LEVEL}"
-
-# ── 2. Create / verify writable directories ───────────────────────────────────
+echo "DATABASE_URL set   : $([ -n "${DATABASE_URL}" ] && echo YES || echo NO)"
+echo "SALT_KEY set       : $([ -n "${LITELLM_SALT_KEY}" ] && echo YES || echo NO)"
+
+# 4. Inject database_url into config.yaml at runtime if DATABASE_URL is set
+# entrypoint runs as user:user who owns /app/litellm/config.yaml (set in Dockerfile)
+CONFIG="/app/litellm/config.yaml"
+if [ -n "${DATABASE_URL}" ]; then
+  if ! grep -q "database_url" "${CONFIG}"; then
+    python3 << PYEOF
+import re
+with open("${CONFIG}", "r") as f:
+    content = f.read()
+content = re.sub(
+    r"(master_key:\s*os\.environ/LITELLM_MASTER_KEY)",
+    r"\1\n  database_url: os.environ/DATABASE_URL",
+    content
+)
+with open("${CONFIG}", "w") as f:
+    f.write(content)
+print("INFO: database_url injected into config.yaml")
+PYEOF
+  else
+    echo "INFO: database_url already present in config.yaml"
+  fi
+fi
 
-# /app/data persists the SQLite DB; may be ephemeral on free-tier HF Spaces.
+# 5. Directories
 mkdir -p "$(dirname "${DB_PATH}")"
-
-# nginx needs these temp dirs when running as non-root
-mkdir -p \
-  /tmp/nginx/client_body \
-  /tmp/nginx/proxy \
-  /tmp/nginx/fastcgi \
-  /tmp/nginx/uwsgi \
-  /tmp/nginx/scgi
-
-# supervisor socket + pid files live in /tmp (non-root writable)
+mkdir -p /tmp/nginx/client_body /tmp/nginx/proxy \
+         /tmp/nginx/fastcgi /tmp/nginx/uwsgi /tmp/nginx/scgi
 mkdir -p /tmp/supervisor
+echo "Directories ready"
 
-echo "✅ Directories ready"
-
-# ── 3. Sanity-check required files baked into the image ──────────────────────
-
-if [ ! -f "/app/litellm/config.yaml" ]; then
-  echo "❌ /app/litellm/config.yaml not found — aborting."
+# 6. Sanity checks
+if [ ! -f "${CONFIG}" ]; then
+  echo "ERROR: ${CONFIG} not found - aborting."
   exit 1
 fi
-echo "✅ LiteLLM config found"
-
 if [ ! -f "/app/frontend/dist/index.html" ]; then
-  echo "❌ Frontend build missing at /app/frontend/dist/index.html"
-  echo "   This should have been built in the Docker image Stage 1."
+  echo "ERROR: frontend build missing - aborting."
   exit 1
 fi
-echo "✅ Frontend build present"
+echo "Config and frontend OK"
 
-# ── 4. Print startup summary ──────────────────────────────────────────────────
-echo ""
 echo "Starting services:"
-echo "  • LiteLLM proxy    → localhost:4000"
-echo "  • Node.js backend  → localhost:3001"
-echo "  • nginx (public)   → 0.0.0.0:7860"
-echo ""
-echo "Access your gateway at: ${GATEWAY_PUBLIC_URL}"
-echo "──────────────────────────────────────────"
+echo "  LiteLLM  -> localhost:4000  (priority 10)"
+echo "  Backend  -> localhost:3001  (priority 20)"
+echo "  nginx    -> 0.0.0.0:7860   (priority 30)"
+echo "Gateway URL: ${GATEWAY_PUBLIC_URL}"
 
-# ── 5. Exec supervisord (replaces this script as PID 1) ──────────────────────
 exec /usr/bin/supervisord -c /app/huggingface/supervisord.conf